5 ms·
Ok, I'll bite. I have been doing break-fix for Windows, *nix, and Mac systems for a long time. I have worshipped at the altar of Russinovich and Sysinternals
by 616c 10y ago
Ok, I'll bite.
I have been doing break-fix for Windows, *nix, and Mac systems for a long time. I have worshipped at the altar of Russinovich and Sysinternals gods for as long. I have wanted to be able to sit with Process Explorer, Process Monitor, and Windbg and know everything that goes wrong with a system from weird driver buginess to Word crash for reasons ignortant users can show me happening once a week but I cannot find evidence. I know the basics, but I really want to go up to the advanced levels with this. After years, Windows is still a black box to me, more than it should be after reading more than basic material, and that upsets me.
I see two problems here:
1) Where is good comprehensive material on the topic?
I see pages like this, but no unified material and training. On the Sysinternals book, I caved and bought the Bible, Sysinternals v6 back when it was current. I routinely show it for geek cred to other IT friends; few even know it exists. I met some more advanced consultants a month ago and learned of the Aaron Margosis companion (https://www.amazon.com/Windows-Sysinternals-Administrators-Reference-Inside-ebook/dp/B00JDMPFO2/ https://www.amazon.com/Windows-Sysinternals-Administrators-R...). But for the advanced stuff for WinDbg I know there are tier 2 customer engineers who know stuff inside out who post blogs like this, but find no really thorough books/material/courses I would gladly pay for to learn the basics of this skillset. Advice? Suggestions? I wish Julia Evans (jvns.ca) counterpart exists for the beauty of Windows debugging tools, but I have not found her/him/it yet.
2) Does tooling exist beyond the Sysinternals and debuggers I keep missing because I am uninformed? Help!?
On the point of Julia Evans, tooling in Windows is good, but I have not found much beyond the blessed debuggers and the gap between these debuggers+Sysinternals stack and that of the raw power tools of the Unix landscape of late: dtrace, strace, ltrace which go into crazy levels of introspection. I looked after reading this and stumbled upon maybe Dr. Memory but have not had time to learn it. Do you have counterpoints or suggestions?
Again, I would love to learn fu like Julia Evans in the Unix space and begin a love affair with the Windows side of debugging tools, but the landscape is more confusing. I would seriously love to hear from you.
Thanks so much for pointing us to DebugDiag. I have never found this and I am checking it out now. Very exciting!
UPDATE: I am reading the Code Machine posts listed in another comment, but it seems that Advanced Windows Debugging book might be the start of what I am looking for. Would love to know if you have other suggestions.
- youdontknowtho 10y agoYeah, there is also training available (plus a cert if you are in to that) on the material in Advanced Windows Debugging.
- hitr 10y agoIf you work with .NET ,best place to learn all common scenarios like hang,crash,high memory are Debugging Demos https://blogs.msdn.microsoft.com/tess/2008/02/04/net-debugging-demos-information-and-setup-instructions/ https://blogs.msdn.microsoft.com/tess/2008/02/04/net-debuggi... Many troubleshooting steps in that blog also covers DebugDiag .DebugDiag is an amazing tool which can help you collect dumps automatically for crash,high memory,IIS slow response etc. Another tool which can help you profile your applications easily is PerfView https://channel9.msdn.com/Series/PerfView-Tutorial https://channel9.msdn.com/Series/PerfView-Tutorial . Perfview is built on the (Windows Event tracing) ETW infrastructure windows have .You can think of it as Lttng or perf_events linux equivalent but built into everything windows have. I think process monitor is also built on ETW. After debugging ( which is not required for lot of scenarios) the most powerfull thing in troubleshooting any issues in Windows is ETW traces IMHO.So understanding and analyzing ETW will help you troubleshoot a lot of issues. https://blogs.msdn.microsoft.com/ntdebugging/2009/08/27/part-1-etw-introduction-and-overview/ https://blogs.msdn.microsoft.com/ntdebugging/2009/08/27/part... XPERF is built to consume ETW traces https://blogs.msdn.microsoft.com/ntdebugging/tag/XPERF/ https://blogs.msdn.microsoft.com/ntdebugging/tag/XPERF/ https://blogs.technet.microsoft.com/askpfeplat/2013/03/22/troubleshooting-windows-performance-issues-using-the-windows-performance-recorder/ https://blogs.technet.microsoft.com/askpfeplat/2013/03/22/tr... Also Advanced Windows debugging[1] and Advanced .NET debugging[2] to be very good for learning debugging in windows land. [1] http://www.amazon.in/Advanced-Debugging-Addison-Wesley-Microsoft-Technology/dp/0321374460 http://www.amazon.in/Advanced-Debugging-Addison-Wesley-Micro... [2]https://www.amazon.com/Advanced-NET-Debugging-Mario-Hewardt/dp/0321578899 https://www.amazon.com/Advanced-NET-Debugging-Mario-Hewardt/...
- 616c 10y agoSeriously, hitr, thanks for you taking the time to respond. Also, the dead comment appears to have alluded to the 71-660. Once other things settle down, I am diving into Sysinternals and these books when I had put them aside. Seriously, thanks a bunch!